feat: enhance image upload tests with HEIC and WebP fixtures

Author: hendrikebbers

backend/src/main/java/com/openelements/crm/company/CompanyController.java

@@ -194,7 +194,7 @@ public void delete(@Parameter(description = "The company ID") @PathVariable fina
     @ApiResponse(responseCode = "400", description = "Invalid file format or size")
     @ApiResponse(responseCode = "404", description = "Company not found")
     public void uploadLogo(@Parameter(description = "The company ID") @PathVariable final UUID id,
-                           @Parameter(description = "The logo image file (JPEG, PNG, or SVG; max 2 MB)") @RequestParam("file") final MultipartFile file) {
+                           @Parameter(description = "The logo image file") @RequestParam("file") final MultipartFile file) {
         try {
             companyService.updateLogo(id, ImageData.of(file));
         } catch (final java.io.IOException e) {

backend/src/test/resources/images/test.heic

@@ -2,24 +2,31 @@
 
 This document inherits all scenarios from spec 101's `behaviors.md` (JPEG and PNG paths). The scenarios below add HEIC and WebP coverage, plus regressions to ensure the existing paths remain green.
 
-Scenarios marked **[fixture-disabled]** are implemented as `@Disabled` tests in v1, waiting on the fixture-provision TODO (`TODO.md`: "HEIC- und WebP-Testfixtures bereitstellen + Tests aktivieren"). They become active once the binary fixtures land.
+**Test fixtures.** Four happy-path fixtures live under `backend/src/test/resources/images/`:
+
+- `images/test.jpeg` — iPhone 15 Pro JPEG with EXIF/GPS, orientation 1
+- `images/test.png` — 800×800 RGB, opaque
+- `images/test.webp` — VP8 lossy, opaque
+- `images/test.heic` — iPhone HEIF/HEVC, opaque
+
+Scenarios marked **[fixture-disabled]** are implemented as `@Disabled` tests in v1 because they need fixture variants not yet on disk (rotated HEIC, alpha images, animated WebP, oversize, probe sample). They become active once those fixtures land (tracked in `TODO.md`: "HEIC- und WebP-Testfixtures bereitstellen + Tests aktivieren").
 
 ## Backend — HEIC upload (new path)
 
-### Opaque HEIC upload is transcoded to JPEG  [fixture-disabled]
+### Opaque HEIC upload is transcoded to JPEG
 
 - **Given** an authenticated user and an existing contact
 - **And** `HeicSupportCheck.isHeicAvailable() == true`
-- **And** an opaque HEIC file ≤ 2 MB (no alpha, no animation)
+- **And** the fixture `images/test.heic` (≤ 2 MB, opaque iPhone HEIC)
 - **When** the client posts to `POST /api/contacts/{id}/photo` with `Content-Type: image/heic`
 - **Then** the response is `200 OK`
 - **And** the contact's `photo_content_type` is `image/jpeg` (not `image/heic`)
 - **And** the stored bytes are valid JPEG and decode to a `BufferedImage` of the original HEIC's dimensions
 - **And** the stored bytes are NOT byte-equal to the uploaded HEIC
 
-### `image/heif` content type is accepted equivalently  [fixture-disabled]
+### `image/heif` content type is accepted equivalently
 
-- **Given** an HEIC file uploaded with `Content-Type: image/heif` (the parent-format MIME type some clients use)
+- **Given** the fixture `images/test.heic` uploaded with `Content-Type: image/heif` (the parent-format MIME type some clients use)
 - **When** the client posts it (size ≤ 2 MB, `heicAvailable == true`)
 - **Then** the response is `200 OK`
 - **And** the stored bytes are a valid JPEG
@@ -40,14 +47,16 @@ Scenarios marked **[fixture-disabled]** are implemented as `@Disabled` tests in
 - **And** the `HeicTranscoderService` was never invoked (verifiable via mock assertions in unit tests)
 - **And** the contact's `photo` column is not modified
 
-### Malformed HEIC is rejected with 400  [fixture-disabled]
+### Malformed HEIC is rejected with 400
 
-- **Given** an upload with `Content-Type: image/heic` whose bytes are not a valid HEIC (random bytes, truncated, or another format mislabelled), size ≤ 2 MB, `heicAvailable == true`
+- **Given** an upload with `Content-Type: image/heic` whose bytes are a programmatically-generated random `byte[]` of length ≤ 2 MB, `heicAvailable == true`
 - **When** the client posts it
 - **Then** the response is `400 BAD REQUEST`
 - **And** the response body contains a recognizable "could not decode HEIC" message
 - **And** the contact's `photo` column is not modified
 
+Note: this scenario uses an in-test-generated random byte array, not a disk fixture — no `@Disabled` needed.
+
 ### HEIC upload returns 415 when libheif is unavailable
 
 - **Given** the backend has booted in an environment where `libheif` / `libheif-plugin-libde265` are missing or broken
@@ -60,10 +69,10 @@ Scenarios marked **[fixture-disabled]** are implemented as `@Disabled` tests in
 
 ## Backend — WebP upload (new path)
 
-### Opaque lossy WebP upload is transcoded to JPEG  [fixture-disabled]
+### Opaque lossy WebP upload is transcoded to JPEG
 
 - **Given** an authenticated user and an existing contact
-- **And** a lossy opaque WebP file ≤ 2 MB
+- **And** the fixture `images/test.webp` (VP8 lossy, opaque, ≤ 2 MB)
 - **When** the client posts to `POST /api/contacts/{id}/photo` with `Content-Type: image/webp`
 - **Then** the response is `200 OK`
 - **And** the contact's `photo_content_type` is `image/jpeg`
@@ -98,14 +107,16 @@ Scenarios marked **[fixture-disabled]** are implemented as `@Disabled` tests in
 - **And** no transcoder invocation occurred
 - **And** the contact's `photo` column is not modified
 
-### Malformed WebP is rejected with 400  [fixture-disabled]
+### Malformed WebP is rejected with 400
 
-- **Given** an upload with `Content-Type: image/webp` whose bytes are not a valid WebP, size ≤ 2 MB
+- **Given** an upload with `Content-Type: image/webp` whose bytes are a programmatically-generated random `byte[]` of length ≤ 2 MB
 - **When** the client posts it
 - **Then** the response is `400 BAD REQUEST`
 - **And** the response body contains a recognizable "could not decode WebP" message
 - **And** the contact's `photo` column is not modified
 
+Note: this scenario uses an in-test-generated random byte array, not a disk fixture — no `@Disabled` needed.
+
 ## Backend — startup probe
 
 ### Successful startup probe sets heicAvailable = true  [fixture-disabled — depends on probe sample]

backend/src/test/resources/images/test.jpeg

@@ -264,36 +264,47 @@ No migration. The `photo` (`BYTEA`) and `photo_content_type` (`VARCHAR(50)`) col
 
 ### 7. Tests
 
-Backend (`backend/src/test/.../contact/`):
+**Fixture inventory.** The user has placed real-world fixtures under `backend/src/test/resources/images/`:
 
-| Scenario | Active in CI? |
-|---|---|
-| Existing JPEG / PNG cases from spec 101 | Active |
-| Happy-path opaque HEIC upload | `@Disabled` (awaits fixture) |
-| HEIC with EXIF orientation 6 (90° CW) is decoded upright | `@Disabled` |
-| HEIC > 2 MB → 400 | `@Disabled` |
-| Malformed HEIC bytes → 400 | `@Disabled` |
-| Happy-path lossy opaque WebP upload | `@Disabled` |
-| Lossless WebP + alpha → flattened on white | `@Disabled` |
-| Animated WebP → first frame stored, no error | `@Disabled` |
-| WebP > 2 MB → 400 | `@Disabled` |
-| Malformed WebP bytes → 400 | `@Disabled` |
-| `HeicSupportCheck` reports `heicAvailable = true` after startup probe | `@Disabled` (needs `/heic-probe/sample.heic`) |
-| HEIC upload when `heicAvailable = false` → 415 | Active (uses a mock `HeicSupportCheck`, no fixture needed) |
-| Rejected MIME types (`image/gif`, `image/bmp`, `image/svg+xml`, `image/avif`, `application/pdf`) → 400 | Active |
+| File | Bytes | Properties |
+|---|---|---|
+| `images/test.jpeg` | 1.4 MB | iPhone 15 Pro JPEG with EXIF (orientation 1, GPS data) |
+| `images/test.png` | 870 KB | 800×800 RGB, opaque (no alpha channel) |
+| `images/test.webp` | 565 KB | VP8 lossy, 3840×5783, opaque |
+| `images/test.heic` | 1.0 MB | iPhone HEIF/HEVC, opaque |
+
+Each is under 2 MB so each is **accepted** by the size cap and exercises the full decode → transcode → store path.
+
+Several edge-case fixtures are **not yet present** and are tracked in `TODO.md` ("HEIC- und WebP-Testfixtures bereitstellen + Tests aktivieren"). Tests that require them ship `@Disabled` with the message `"Awaiting fixture — see TODO.md: HEIC- und WebP-Testfixtures bereitstellen"`. Missing fixtures:
 
-All `@Disabled` annotations carry the message `"Awaiting test fixtures — see TODO.md: HEIC- und WebP-Testfixtures bereitstellen"` so the trail is unambiguous when a developer or reviewer trips over them.
+- **EXIF-orientation HEIC** (e.g. `iphone-portrait-orient-6.heic`) — for the "decoded upright" test.
+- **Transparent PNG / lossless WebP + alpha** — for the "flatten on white" tests.
+- **Animated WebP** — for the "silent first frame" test.
+- **Oversized fixtures (> 2 MB) per format** — for the size-cap test. The existing four fixtures are all under 2 MB so a separate `oversize.heic` / `oversize.webp` / `oversize.png` is required.
+- **Probe sample `heic-probe/sample.heic`** (< 10 KB target) — bundled into the production JAR for `HeicSupportCheck`. The existing 1 MB `test.heic` is too large to ship inside the production artifact.
 
-Fixture files (when produced): tiny binaries (< 2 KB each) under `backend/src/test/resources/contact-photo/`:
+**Malformed fixtures** are generated programmatically at test time (random byte arrays with the matching `Content-Type`); no disk asset needed.
 
-- `iphone-portrait-orient-6.heic` — real iPhone HEIC with non-trivial EXIF orientation
-- `opaque.heic` — simplest HEIC
-- `lossy-opaque.webp`
-- `lossless-alpha.webp`
-- `animated.webp`
-- `oversize.heic` / `oversize.webp` — > 2 MB
-- `malformed.heic` / `malformed.webp` — random bytes with the matching content-type header
-- `heic-probe/sample.heic` — also shipped under `backend/src/main/resources/` for the startup probe
+**Test matrix:**
+
+| Scenario | Active in CI? |
+|---|---|
+| Existing JPEG / PNG cases from spec 101, using `images/test.jpeg` and `images/test.png` | Active |
+| JPEG passthrough preserves EXIF including GPS (uses `images/test.jpeg`) | Active (spec 101 contract; verified here as a regression) |
+| Happy-path opaque HEIC upload (uses `images/test.heic`) | Active |
+| Happy-path lossy opaque WebP upload (uses `images/test.webp`) | Active |
+| HEIC upload when `heicAvailable = false` → 415 (uses a mock `HeicSupportCheck`) | Active |
+| Rejected MIME types (`image/gif`, `image/bmp`, `image/svg+xml`, `image/avif`, `application/pdf`) → 400 | Active |
+| Malformed HEIC bytes → 400 (programmatic random bytes) | Active |
+| Malformed WebP bytes → 400 (programmatic random bytes) | Active |
+| HEIC with EXIF orientation 6 (90° CW) is decoded upright | `@Disabled` (awaits fixture) |
+| HEIC > 2 MB → 400 | `@Disabled` (awaits fixture) |
+| WebP > 2 MB → 400 | `@Disabled` (awaits fixture) |
+| PNG > 2 MB → 400 (also spec 101) | `@Disabled` (awaits fixture) |
+| Lossless WebP + alpha → flattened on white | `@Disabled` (awaits fixture) |
+| Transparent PNG → flattened on white (also spec 101) | `@Disabled` (awaits fixture) |
+| Animated WebP → first frame stored, no error | `@Disabled` (awaits fixture) |
+| `HeicSupportCheck` reports `heicAvailable = true` after startup probe | `@Disabled` (awaits small probe sample) |
 
 Frontend (`frontend/src/components/__tests__/`):